The DNS SuperTool runs a complete DNS health audit of a domain in a single click. It resolves core records (A, AAAA, CNAME, NS, TXT, SOA, CAA) and compares answers across Cloudflare and Google DNS-over-HTTPS to flag propagation mismatches, then checks MX routing, SPF, DKIM and DMARC authentication, DNSSEC chain integrity, dangling CNAME takeover risk, wildcard DNS, and Spamhaus blacklist status for the IPs behind your A and MX records — all client-side in your browser, so the domain you test never leaves your machine.
Enter a domain name (example.org) and optionally a DKIM selector (e.g. google, selector1, s1). Click "Run Full Diagnostic". Each check appears as a tile that shows a checking state, then resolves to a pass, fail or needs-input icon. Click any tile to expand it and see the records found, what a healthy record looks like, and a plain-English explanation of any issue. Use "Copy full report" to copy a plain-text summary of every result.
Input: Domain — e.g. example.org.
The top banner summarises the audit: green "All checks passed", amber "X warnings" (e.g. DMARC in monitor-only mode), or red "X issues found". Each tile is one check. A green check means the check passed; a red X means a problem was found (with a fix in the expanded view); an amber triangle means a warning or monitoring-only state; a blue info icon means the check needs input or could not be completed. Expanded tiles show the exact records returned, a healthy example, and a one-sentence impact and fix. All queries run client-side over DNS-over-HTTPS, so no third party sees which domain you are testing.
→ One-click pre-launch DNS health audit for a new domain.
→ Verify SPF, DKIM and DMARC are aligned before a mail migration.
→ Check whether a record change has propagated across resolvers.
→ Generate a plain-text DNS report to attach to a support ticket.
Yes. Every query is performed client-side in your browser using CORS-enabled DNS-over-HTTPS endpoints (Cloudflare and Google). The domain you test is never sent to our servers, so no third party — including us — learns which domain you are auditing.
It means a subdomain has a CNAME pointing at a third-party service (like a defunct SaaS provider or cloud bucket) that you no longer control. Attackers can re-create the target resource and serve content or host phishing on your subdomain. Remove the stale CNAME or reclaim the target to close the takeover risk.
p=none is monitor-only: it tells receivers to take no action on failing mail, only send reports. It is a valid starting point but offers no enforcement, so the tool flags it amber to remind you to move toward quarantine or reject once you have reviewed the reports.